CVE-2026-3971
Published: 12 March 2026
Summary
CVE-2026-3971 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda I3 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents stack-based buffer overflow by validating and sanitizing the manipulated index/GO argument in the formwrlSSIDset function.
Implements memory protections such as stack canaries and non-executable stack to block arbitrary code execution from the buffer overflow.
Requires timely flaw remediation through vendor patches or workarounds to eliminate the buffer overflow vulnerability in the Tenda i3 firmware.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote stack-based buffer overflow in public-facing web form handler (/goform/wifiSSIDset) on network device directly enables T1190 (Exploit Public-Facing Application) for initial access/RCE; low-privileged web access to full code execution maps to T1068 (Exploitation for Privilege Escalation).
NVD Description
A vulnerability has been found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset. The manipulation of the argument index/GO leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2026-3971 is a stack-based buffer overflow vulnerability in the formwrlSSIDset function within the /goform/wifiSSIDset file of Tenda i3 firmware version 1.0.0.6(2204). The flaw is triggered by manipulation of the index/GO argument and is classified under CWE-119, CWE-121, and CWE-787. It was published on 2026-03-12 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A low-privileged remote attacker can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary code execution via the buffer overflow.
VulDB advisories document the issue under identifiers like ctiid.350406 and id.350406, confirming remote exploitability. Proof-of-concept exploits are publicly disclosed on GitHub repositories, including demonstrations of buffer overflows targeting the formwrlSSIDset and index components, indicating they may be actively used.
The exploit disclosure heightens risk for unpatched Tenda i3 devices, as no vendor patches are referenced in available sources.
Details
- CWE(s)